Threat actorhigh
UNC7017 hijacks AOMEI updates for minutes to plant backdoors
Original title: Hackers Hijack AOMEI Software Updates for Just 5 Minutes to Secretly Install Backdoors
AI summary · x-ai/grok-4.7Summaries by Vani AI
Tampered update configs in brief windows between April and July 2026 could leave CROSSROAD and SHINYROAD after the servers were fixed.
Google’s GTIG and Mandiant say UNC7017 repeatedly changed two AOMEI update configuration files for only minutes at a time between April and July 2026. AOMEI Backupper clients that checked during a window could download a malicious archive and run it through the notification feature, without a software flaw or a user opening a suspicious file. The chain, tracked as CROSSROAD and SHINYROAD, also used scheduled Radmin execution, a side-loaded DLL and, later, ADAPTAGENT disguised as Nitro PDF. On July 20 a one-pixel notification could coerce NetNTLMv2 authentication over WebDAV. AOMEI told Google it secured the distribution servers; that does not remove malware already installed.
Unconfirmed: The full number of impacted systems is not known.
Key facts
- Recorded windows lasted ten minutes on May 28, six on July 16 and five on July 20.
- Attackers restored original settings after each window, so later checks saw clean files.
- July delivery used a public Google Cloud Storage bucket after Alibaba Cloud storage.
- CROSSROAD arrived as upgrade-now.exe and scheduled legitimate Radmin every three hours.
- A BlkScrDl.dll loaded by Radmin started the SHINYROAD backdoor.
Security assessment · AI, from the article
Impact: Backdoor install and possible NetNTLMv2 credential theft
| Product | Affected |
|---|---|
| AOMEI Backupper | — |
What to do
- 1.Review updater child processes, Radmin or Nitro scheduled tasks, and cached AOMEI configuration files.
- 2.Check proxy and firewall logs for the campaign period, not only the live update server.
- 3.Treat server-side fixes as incomplete until endpoints that updated in the windows are checked.
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1053.005 Scheduled TaskT1574.002 DLL Side-LoadingT1187 Forced Authentication
- Vendors
- AOMEI
- Products
- AOMEI BackupperRadmin
- Threat actors
- UNC7017
- Malware
- CROSSROADSHINYROADADAPTAGENT
- Organizations
- Google Threat Intelligence GroupMandiantManageEngine
- Countries
- India
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | aomei.storage-data.com | ress 96.126.191.98 Domain promotion.storage-data.com Domain aomei.storage-data.com Domain storage-data.com Domain serv.oss-cn-hongkong.aliyunc |
| domain | promotion.storage-data.com | 84 IP address 47.239.60.117 IP address 96.126.191.98 Domain promotion.storage-data.com Domain aomei.storage-data.com Domain storage-data.com Domai |
| domain | serv.oss-cn-hongkong.aliyuncs.com | omain aomei.storage-data.com Domain storage-data.com Domain serv.oss-cn-hongkong.aliyuncs.com URL https://promotion.storage-data.com/download/abpopup/upg |
| domain | storage-data.com | .com/download/abpopup/upgrade-now.zip URL https://promotion.storage-data[.]com/config/component.zip URL https://promotion.storage-data.c |
| ipv4 | 47.239.60.117 | r IP address 8.210.84.56 IP address 8.218.65.184 IP address 47.239.60.117 IP address 96.126.191.98 Domain promotion.storage-data.com |
| ipv4 | 8.210.84.56 | d7ac4 Network and host indicators Type Indicator IP address 8.210.84.56 IP address 8.218.65.184 IP address 47.239.60.117 IP address |
| ipv4 | 8.218.65.184 | indicators Type Indicator IP address 8.210.84.56 IP address 8.218.65.184 IP address 47.239.60.117 IP address 96.126.191.98 Domain pr |
| ipv4 | 96.126.191.98 | IP address 8.218.65.184 IP address 47.239.60.117 IP address 96.126.191.98 Domain promotion.storage-data.com Domain aomei.storage-data |
| md5 | 31323e7e738230fa6a8deef2b7894666 | l.dll ; Eztwain4.dll MD5 values in tampered update settings 31323E7E738230FA6A8DEEF2B7894666 ; BF73C4391B58CA95220CE3AE03F66DCF Note: IP addresses and d |
| md5 | bf73c4391b58ca95220ce3ae03f66dcf | tampered update settings 31323E7E738230FA6A8DEEF2B7894666 ; BF73C4391B58CA95220CE3AE03F66DCF Note: IP addresses and domains are intentionally defanged ( |
| sha256 | 11e576df44e9c9eef72b9f5b699291bcdb200a19130778ec231e5b0987b913ad | 635e54f8df0f6eec7 upgrade-now.exe — May 20 CROSSROAD loader 11e576df44e9c9eef72b9f5b699291bcdb200a19130778ec231e5b0987b913ad upgrade-now.exe — July 16 CROSSROAD loader 9a58e8f49edf5644 |
| sha256 | 14b31918075e6130b9123158743db0a81e2d7bfcf6d39731ee7d9200a98cd591 | 6efcdcf251190f2e7c NitroPromotion.exe — ADAPTAGENT launcher 14b31918075e6130b9123158743db0a81e2d7bfcf6d39731ee7d9200a98cd591 Eztwain4.dll — ADAPTAGENT helper DLL 8c8090aca8ddb1cf968d2b |
| sha256 | 286e0d8c7bdfaa7c251a3e8f0f2fefbe25c67586c0149d39b1095c89dc6023c8 | 933923dd42f75a1c5934 Notifycfg.ini — July 20 WebDAV version 286e0d8c7bdfaa7c251a3e8f0f2fefbe25c67586c0149d39b1095c89dc6023c8 down_html.ini — tampered July 20 f2a7d0a4c8613a9cdd31ede613 |
| sha256 | 2d99e9d732ff9304d97c7856b052ca520ae689fec1ce86df724de741913afa4b | cription SHA-256 WinLpcDl.dll — legitimate Radmin component 2d99e9d732ff9304d97c7856b052ca520ae689fec1ce86df724de741913afa4b WinLpcDl2.dll — legitimate Radmin component dad559ae9bc9777 |
| sha256 | 4b4d25b3501519476f9a62a88a781e4f446f669280eb5e98c6b96eb6d3743431 | cb0d288231c61ffe9406c7045b metadata.dat — encrypted payload 4b4d25b3501519476f9a62a88a781e4f446f669280eb5e98c6b96eb6d3743431 axmlx. — decoy file d7cfa659d224928e7b72c806dcf2169594d993e |
| sha256 | 4c0a75e0f62ddc0bb350c224fe996f3b2ab08dcb0d288231c61ffe9406c7045b | fd42ec8be22189d51cab1e config.zip — Python bytecode archive 4c0a75e0f62ddc0bb350c224fe996f3b2ab08dcb0d288231c61ffe9406c7045b metadata.dat — encrypted payload 4b4d25b3501519476f9a62a88a |
| sha256 | 5837bc26a73cfb46ffd466cf889f03ce2f6a48f1f3fd42ec8be22189d51cab1e | 0ad37a688098c5f8f511410157c8b8 BlkScrDl.dll — malicious DLL 5837bc26a73cfb46ffd466cf889f03ce2f6a48f1f3fd42ec8be22189d51cab1e config.zip — Python bytecode archive 4c0a75e0f62ddc0bb350c2 |
| sha256 | 6670ab3f0434a42f33416f8354150b1701e7615f3cfa2f1635e54f8df0f6eec7 | cription SHA-256 upgrade-now.zip — May 20 CROSSROAD archive 6670ab3f0434a42f33416f8354150b1701e7615f3cfa2f1635e54f8df0f6eec7 upgrade-now.exe — May 20 CROSSROAD loader 11e576df44e9c9eef |
| sha256 | 7b252be444dee2fb2a57043a823dc5b5e1fae970aea91ee2c8339aa70329969d | e97c03cd721f70d2eca7f37f2681fc4 abe.exe — secondary payload 7b252be444dee2fb2a57043a823dc5b5e1fae970aea91ee2c8339aa70329969d Other file and configuration hashes File or description SHA |
| sha256 | 8c8090aca8ddb1cf968d2b810457e0cfce97c03cd721f70d2eca7f37f2681fc4 | d39731ee7d9200a98cd591 Eztwain4.dll — ADAPTAGENT helper DLL 8c8090aca8ddb1cf968d2b810457e0cfce97c03cd721f70d2eca7f37f2681fc4 abe.exe — secondary payload 7b252be444dee2fb2a57043a823dc5b |
| sha256 | 8fbaa74b27dc1e89abfc694e834378746f0ad37a688098c5f8f511410157c8b8 | 64fc8999710314109464 RuntimeComponent.dll — PocketPy engine 8fbaa74b27dc1e89abfc694e834378746f0ad37a688098c5f8f511410157c8b8 BlkScrDl.dll — malicious DLL 5837bc26a73cfb46ffd466cf889f03 |
| sha256 | 924ad92d89dde577d5858b2ebc5703a485467842d78e98b75019b2e2e0ac3fe6 | 8ac268591d4bbb78621a73acbd down_html.ini — tampered July 16 924ad92d89dde577d5858b2ebc5703a485467842d78e98b75019b2e2e0ac3fe6 Notifycfg.ini — tampered July 16 d2f9ef2429312667f0512504b6 |
| sha256 | 9a58e8f49edf5644e5728f74cf36f560d3d486fa51db4db69d927963c7aca450 | 231e5b0987b913ad upgrade-now.exe — July 16 CROSSROAD loader 9a58e8f49edf5644e5728f74cf36f560d3d486fa51db4db69d927963c7aca450 upgrade-now.exe — July 20 CROSSROAD loader b360b6db0c2b6683 |
| sha256 | 9ed503c6a9a3a493fb859401e9ed469eed77ab9927341964d6dbfbfa6255aeba | 21f6724c157ae21 upgrade-now.zip — July 20 CROSSROAD archive 9ed503c6a9a3a493fb859401e9ed469eed77ab9927341964d6dbfbfa6255aeba component.zip / en.zip — SHINYROAD package d167bc898e856da8 |
| sha256 | b360b6db0c2b668317edc1504a7c39ef047f0d925c8f113b521f6724c157ae21 | 9d927963c7aca450 upgrade-now.exe — July 20 CROSSROAD loader b360b6db0c2b668317edc1504a7c39ef047f0d925c8f113b521f6724c157ae21 upgrade-now.zip — July 20 CROSSROAD archive 9ed503c6a9a3a49 |
| sha256 | d167bc898e856da8a4003cb4dfc7de55fea109eee3cd64fc8999710314109464 | d6dbfbfa6255aeba component.zip / en.zip — SHINYROAD package d167bc898e856da8a4003cb4dfc7de55fea109eee3cd64fc8999710314109464 RuntimeComponent.dll — PocketPy engine 8fbaa74b27dc1e89abfc |
| sha256 | d2f9ef2429312667f0512504b6a19ba4a9cc5514f1b2933923dd42f75a1c5934 | 42d78e98b75019b2e2e0ac3fe6 Notifycfg.ini — tampered July 16 d2f9ef2429312667f0512504b6a19ba4a9cc5514f1b2933923dd42f75a1c5934 Notifycfg.ini — July 20 WebDAV version 286e0d8c7bdfaa7c251a |
| sha256 | d71a119b4950ee88dd36205176d989a64df5248ac268591d4bbb78621a73acbd | d0e650c951 Nitro_Scan2PDFApp.exe — legitimate signed binary d71a119b4950ee88dd36205176d989a64df5248ac268591d4bbb78621a73acbd down_html.ini — tampered July 16 924ad92d89dde577d5858b2ebc |
| sha256 | d7cfa659d224928e7b72c806dcf2169594d993ecf6422e6efcdcf251190f2e7c | a781e4f446f669280eb5e98c6b96eb6d3743431 axmlx. — decoy file d7cfa659d224928e7b72c806dcf2169594d993ecf6422e6efcdcf251190f2e7c NitroPromotion.exe — ADAPTAGENT launcher 14b31918075e6130b9 |
| sha256 | dad559ae9bc977783c7251591eeb7aa432b860ce821ccf10b1260fd0e650c951 | 24de741913afa4b WinLpcDl2.dll — legitimate Radmin component dad559ae9bc977783c7251591eeb7aa432b860ce821ccf10b1260fd0e650c951 Nitro_Scan2PDFApp.exe — legitimate signed binary d71a119b49 |
| sha256 | f2a7d0a4c8613a9cdd31ede6131b27040c0571ca97970b245a710191806d7ac4 | 86c0149d39b1095c89dc6023c8 down_html.ini — tampered July 20 f2a7d0a4c8613a9cdd31ede6131b27040c0571ca97970b245a710191806d7ac4 Network and host indicators Type Indicator IP address 8.210 |
From the original article
5 min read at cybersecuritynews.com
A short-lived change to AOMEI’s software update system gave hackers a way to deliver malware through a trusted route. Google Threat Intelligence Group (GTIG) and Mandiant found that attackers repeatedly altered AOMEI’s update settings for only a few minutes at a time between April and July 2026. Any AOMEI Backupper computer checking for updates during […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.